Secure Your Systems with Effective Vulnerability Management

Vulnerabilities in business-critical applications like SAP and Oracle can be exploited by bad actors, and the risk to organizations has been growing over time. According to the United States Department of Homeland Security Cyber and Infrastructure Security Agency (CISA), there have been five US-CERT alerts about SAP and Oracle applications since 2016. US-CERT is the US Cyber Emergency Readiness Team and part of CISA. US-CERT is responsible for disseminating cyber-threat warning information as well as analyzing cyber threats and vulnerabilities. The organization collaborates with governmental agencies as well as the private sector. Onapsis Research Labs has been at the forefront of developing the research behind these alerts.

It is critical for organizations to understand the risks presented by these vulnerabilities. CISA has issued multiple US-CERT alerts for business-critical systems, noting that affected organizations could be subject to “theft of sensitive data, financial fraud, disruption of critical business processes, ransomware, and halt of all operations.” However, it is still challenging to implement effective vulnerability management processes even for organizations that are well aware of these risks. This is due to the decreased amount of time between a vulnerability being identified and disclosed and a bad actor taking advantage of the vulnerability.

Onapsis research has found that there can be as little as 24 hours between the disclosure of a vulnerability and observable scanning by attackers looking for vulnerable systems, and just 72 hours before a functional exploit is available. Many organizations do not have security best practices, tools, or staffing levels in place to address vulnerabilities within this accelerated time frame. Bad actors are not only exploiting vulnerabilities in business-critical systems, they are doing so at a faster pace than ever before.

The concept of building a secure fortress around the “crown jewels” of SAP and Oracle applications and data is a longstanding security strategy. However, the traditional security layered stack approach of metaphorical high walls and a moat around the kingdom no longer offers sufficient protection. Although organizations should absolutely deploy a defense-in-depth strategy, a vulnerability can still be (and frequently is) found and exploited within any one of these layers of defense.

Ransomware (and malware), misconfigurations, or stolen credentials can be leveraged to breach any layer of security in front of the application layer, allowing a threat actor to move laterally to infiltrate business applications. Some threat actors are even knowledgeable enough to attack the application layer directly.

60% OF IT AND SECURITY PRACTITIONERS CITE APPLICATION PROTECTION AS A TOP OBJECTIVE

Identifying vulnerabilities across an IT landscape is a manual, laborious effort. This is why many, if not close to all, organizations deploy traditional vulnerability management solutions that scan for known threats and vulnerabilities. These solutions focus on a broad range of systems and applications, including network security systems, the layers of protection that surround SAP and Oracle applications, and data. Vulnerability management tools commonly perform scans and compile a list of highlighted vulnerabilities and recommendations for remediation, mitigation, or acceptance. Unfortunately, by design, they are designed to highlight issues across many systems and are ill-equipped to scan SAP and Oracle applications for vulnerabilities that may be used as attack vectors. These traditional solutions are ineffective at identifying a large number of application vulnerabilities such as misconfigurations, overprivileged roles, or unapplied patches. More critically, there’s still the human element. Even if a vulnerability is found, the time to resolve it is long. The average time it takes to fix critical cybersecurity vulnerabilities is 205 days.

IT TAKES AN AVERAGE OF 205 DAYS TO FIX CRITICAL CYBERSECURITY VULNERABILITIES

Gartner predicts that nearly $4B of global security and risk management will be allocated to application security in 2021. Regardless, budgets are finite and even with a substantial hiring budget, there is often a lack of qualified candidates. Even an organization with a well-staffed team is challenged with limits on their time as they prioritize workloads.

Complex security notes with multiple vulnerability patches and instructions and varying levels of severity are released on a monthly basis. This makes it extremely challenging especially for enterprises managing dozens of applications in production.

ACCORDING TO GARTNER, $4 BILLION WILL BE SPENT ON APPLICATION SECURITY GLOBALLY IN 2021

Managing all of these patching efforts is a time consuming process and an additional burden for the team. This can result in a rushed or sometimes complacent patch management process. Critical patches may be ignored or deprioritized (in relation to other jobs to be done). Additionally, there may be long backlogs and lead times until patches are actually implemented and verified. Patch management is only one part of mitigating risk for business-critical applications like SAP and Oracle. Misconfigurations or overprivileged “all-access” roles are also viable threat vectors used to gain access. All of these leave enterprises vulnerable to attack.

Because business applications are at the core of every organization, an exploitation of a vulnerability has significant consequences. Due to the valuable data these systems contain, there has been a rise in threat actors targeting their vulnerabilities. The accelerated pace of digital transformation and the rapid migration from on-premises to hybrid and cloud infrastructure have dramatically increased the risk to these systems. Yet despite the increased risk, these applications are often out-of-scope for traditional vulnerability management tools and security teams. They are typically managed by information technology professionals who are focused on development and uptime as opposed to security. This further compounds the complexity associated with protecting these applications from vulnerabilities.